core: Suspend cell before its destruction

To avoid that CPU parking races with INIT/SIPI signals sent by not yet
parked CPUs of the same cell, stop all cell CPUs first.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
core: Enforce cell creation and hypervisor shutdown to run over Linux

The rule is already encoded for cell destruction, also establish it
formally for cell creation and Jailhouse shutdown: The code is not yet
prepared to take those commands over non-Linux cell. May change one day
(if there will be a use case), but for now play safe and reject rule
violations, now with the error code -EPERM.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
x86: Clear APIC on INIT emulation and shutdown

Make sure no problematic part of the previous APIC state leaks across
an INIT signal or the shutdown of non-Linux cells.

TODO: Drain ISR and IRR